doc: explain why numeric suffixes on function names are avoided

Author: franckferman

README.md

@@ -108,6 +108,8 @@ The pool names are intentionally generic — they are indistinguishable from fun
 
 On top of that, junk functions and randomized routing tokens add further noise: each build looks like a different application, not a variant of the same tool.
 
+> **Design note — why no random numeric suffix (`fetchClusterStatus_4823`):** appending digits would make every name look machine-generated at a glance — no real PHP codebase does this. It would destroy the "legitimate app" camouflage and, worse, create its own YARA signature (`[a-zA-Z]+_\d+`). The pool size (275 names, ~20 drawn per build) already makes per-build combinations astronomically large; suffixes add risk, not safety.
+
 ### 2. Routing token randomization
 
 The AJAX routing parameter `?feature=` and its values (`shell`, `hint`, `pwd`, `upload`) are replaced by random alphanumeric tokens generated at build time and injected coherently into both PHP and JS.